Hi,
This is the second time I'm requesting help for setting up a simple, free Hotspot. (I hope someone responds this time!) I started over and imitated the technique described here (a few modifications were made)
Here is my setup:
Internet (DSL)
|
Router (Linksys RV0041) ---- Internal Network Clients
|
|
Wireless Router (Linksys WRT54GL)
|
|
Free Wireless Clients
The RV0041 router has IP address 192.168.0.1 and assigns IP address 192.168.0.112 to the WRT54GL (forcefully via DHCP).
Wireless Clients can resolve host names. That's about it. Ping does not work. Wireless clients are able to SSH into White Russian and ping from there.
-----------------------
/etc/firewall.user
-----------------------
#!/bin/sh
# Copyright (C) 2006 OpenWrt.org
# Original firewall.user commands here:
iptables -F input_rule
iptables -F output_rule
iptables -F forwarding_rule
iptables -t nat -F prerouting_rule
iptables -t nat -F postrouting_rule
iptables -F input_wan
iptables -F forwarding_wan
iptables -t nat -F prerouting_wan
####################################
# New firewall.user commands here:
#
# INPUT
#
echo "INPUT"
echo " * Flush"
iptables -t filter -F
iptables -t filter -X
iptables -t nat -F
iptables -t nat -X
iptables -N input_rule
iptables -N output_rule
iptables -N forwarding_rule
iptables -t nat -N prerouting_rule
iptables -t nat -N postrouting_rule
echo " * DROP"
iptables -P INPUT DROP
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --tcp-flags SYN SYN --tcp-option \! 2 -j DROP
echo " * ACCEPT"
iptables -A INPUT -j input_rule
iptables -A INPUT -j ACCEPT # permitir de todas las ifs
iptables -A INPUT -p icmp -j ACCEPT # allow ICMP
iptables -A INPUT -p gre -j ACCEPT # allow GRE
# Rechazar el resto de las cosas
iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable
#
# OUTPUT
#
echo "OUTPUT"
echo " * DROP"
iptables -P OUTPUT DROP
iptables -A OUTPUT -m state --state INVALID -j DROP
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
echo " * ACCEPT"
iptables -A OUTPUT -j output_rule
iptables -A OUTPUT -j ACCEPT # dejar salir todo
# Rechazar el resto de las cosas
iptables -A OUTPUT -p tcp -j REJECT --reject-with tcp-reset
iptables -A OUTPUT -j REJECT --reject-with icmp-port-unreachable
#
# FORWARD
#
echo "FORWARD"
echo 1 > /proc/sys/net/ipv4/ip_forward
echo " * DROP"
iptables -P FORWARD DROP
iptables -A FORWARD -m state --state INVALID -j DROP
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
echo " * ACCEPT"
iptables -A FORWARD -j forwarding_rule
iptables -A FORWARD -i br0 -o br0 -j ACCEPT
iptables -A FORWARD -i br0 -o eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -o br0 -j ACCEPT
echo " * MASQ"
iptables -t nat -A PREROUTING -j prerouting_rule
iptables -t nat -A POSTROUTING -j postrouting_rule
iptables -t nat -A POSTROUTING -j MASQUERADE-----------------------
NVRAM
-----------------------
# switch: client DHCP
nvram set lan_ifname=br0
nvram set lan_proto=dhcp
# bridge switch+wan, wifi is not part of br0
nvram set lan_ifnames="vlan0 vlan1"
# wan is included in br0
nvram set wan_ifname=vlan1
nvram set wan_proto=none
# wifi
nvram set wifi_ifname=eth1
nvram set wifi_proto=static
nvram set wifi_ipaddr=192.168.1.1
nvram set wifi_netmask=255.255.255.0
# Wireless config
nvram set wl0_mode=ap
nvram set wl0_ssid=Hookah
nvram set wan_hostname=hookah